I3157 — A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do

✕BLOCKED wave 2 · p2 · implementation profile · parallel safe

Part of repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks.

Objective

Prove I1801's kind from outside the tool's tree: a fixture adopter declares a scripted capability, it is discovered and projected, and capabilities explain shows its origin file, declared effect, exposure ceiling and the projections it reaches; a call above the ceiling from MCP or HTTP is refused.

Why

Owner, 2026-10-13: pluggable, extensible from outside through plugins. ADR 0069 holds the effect and exposure ceilings; I1801 proves them inside this repository only. It extends milestone automation. Sources: chatgpt-majordomus:c110#4, chatgpt-majordomus:c230#2, chatgpt-majordomus:c244#6.

Current state

No scripted capability exists yet (I1801 BLOCKED).

Desired state

An adopter fixture case.

Scope

• apps/majordomus-cli/src/script
• docs/CAPABILITIES.md
• apps/majordomus-cli/src/capability/registry.rs
• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/src/capability/executor.rs
• apps/majordomus-cli/src/capability/module.rs
• apps/majordomus-cli/src/capability/builtin/capabilities.rs

Out of scope

• Native or WASM plugins
• A plugin marketplace

Dependencies

• I1801○READY A scripted capability is a kind, discovered and registered, runnable and projected like any capability

What waits on this

• I3305✕BLOCKED A scripted capability installed from outside the repository registers like one inside it
• I3306✕BLOCKED An external scripted capability runs under default-deny grants, bounded, and leaves an audit record

Acceptance criteria

• An adopter-declared scripted capability appears on CLI, MCP and OpenAPI
• explain names origin, effect and ceiling
• An over-ceiling call from MCP is refused
• Each new case named here takes its number from `scripts/case-numbers next` and is announced on the board before the file is written (ADR 0053); a case number written in this record before that is provisional

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib script::

Evidence required

• case_adopter_scripted_capability

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3157.yaml. Read it back with majordomus plan show I3157.